Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Callum_f
Callum_f
Explorer
Member since:
07-20-2021
06-22-2022
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 07-20-2021 |
Activity Feed
- Posted Re: Edit the Output Given by Sub Search on Splunk Search. 06-21-2022 11:06 PM
- Karma Re: Edit the Output Given by Sub Search for ITWhisperer. 06-21-2022 11:04 PM
- Karma Re: Can a subsearch return only the value (without the fieldname)? for gkanapathy. 06-21-2022 09:12 PM
- Posted Is there a way to edit the output given by sub search? on Splunk Search. 06-21-2022 09:01 PM
- Tagged Is there a way to edit the output given by sub search? on Splunk Search. 06-21-2022 09:01 PM
- Posted Re: Pass all Stats Values retrieved from a Query into a new Query on Splunk Search. 06-21-2022 05:33 PM
- Posted Re: Pass all Stats Values retrieved from a Query into a new Query on Splunk Search. 06-20-2022 09:59 PM
- Posted How do I Pass all Stats Values retrieved from a Query into a new Query? on Splunk Search. 06-20-2022 09:18 PM
- Posted Search results between a certain number when result has a letter before number e.g C1000 on Splunk Search. 07-21-2021 09:38 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-21-2021 07:58 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-21-2021 07:26 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-21-2021 04:22 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-20-2021 10:24 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-20-2021 10:11 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-20-2021 09:41 PM
- Posted Re: Create time chart for frequency of results from a specific search on Splunk Search. 07-20-2021 09:12 PM
- Posted Create time chart for frequency of results from a specific search on Splunk Search. 07-20-2021 07:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-21-2022
11:06 PM
@ITWhisperer It works thank you very much 🙂 I need to search over the last 30 days but it seems to crash with a time of over 24 hours. Is there a way to break the search up so it can run as the sub search is giving a large number of values that are then searched on.
... View more
06-21-2022
09:01 PM
I have a sub query that gives the output example below
Sub Query
[ search index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer")
| fields error.requestId
| rename error.requestId as requestId
| dedup requestId
| format ]
Output
( requestId="jjadjdfjjedd_jehdfjdjfhj" ) OR ( requestId="jgjfnfdn_jrhfjdbfd" )....
I need to edit the format that is returned from the first query.
Is there a way to change the search to something less specific? Such as
(*jjadjdfjjedd_jehdfjdjfhj*) OR (*jgjfnfdn_jrhfjdbfd*) .....
As I need to find all events that include the requestId, not just when it is specific to that variable.
... View more
- Tags:
- search
06-21-2022
05:33 PM
Hi @isoutamo Thank you for the assistance 🙂 Your query works 🙂 However I need to edit the format that is returned from the first query. Currently the format is ( requestId="jjadjdfjjedd_jehdfjdjfhj" ) OR ( requestId="jgjfnfdn_jrhfjdbfd" ).... Is there a way to change the search to something less specific? Such as (*jjadjdfjjedd_jehdfjdjfhj*) OR (*jgjfnfdn_jrhfjdbfd*) ..... As I need to find all events that include the requestId, not just when it is specific to that variable. Thank you again, Callum
... View more
06-20-2022
09:59 PM
Hi @marysan I have tried to implement your solution but have no luck, do I substitute the "second_query for example" text for something else? Thanks, Callum
... View more
06-20-2022
09:18 PM
I am using the query below to gather all the request IDs of when an error occurs when calling an api. It provides a list of request ids (over 1000 per hour) in a table format.
index=prod_diamond sourcetype=CloudWatch_logs source=*downloadInvoice* AND *error* NOT ("lambda-warmer") | fields error.requestId | rename error.requestId as requestId | stats values by requestId
I want to then pass all the values gained from the query into a new query to find what device each requestId is coming from. The new query would look something like this.
*requestId_1* OR *requestId_2* OR ....requestId_1000* *ChannelName* *lambda*
This query will then be used to find the frequency of each device this error is occurring on.
Is there a way to pass all the values retrieved from the first query into the second query within that format?
Please help 🙂
... View more
07-21-2021
09:38 PM
Hey Everyone, I am trying to search for a field to see how much a customer is spending but there is a letter in front of it. e.g. "cost" : "C1000" showing they spent $1000. So for example I want to search when the user spends between C1000 and C20000. is there a way to remove the C and search the numbers of the result? this is what I have so far index="silverprod" source=*finance* ("Lambda" "Payload") NOT (lambda-warmer) *topup*
... View more
07-21-2021
07:58 PM
Hi @venkatasri unfortunately that didn't work 😞 I am not concerned with repeat users now, don't know if that changes anything. is there a way to take off the C in the search so it just looks for the numbers in the cost parameter?
... View more
07-21-2021
07:26 PM
Hi @venkatasri Sorry to keep asking question, I just wanted to ask if there was a way to search a field like the user field to see how much they are spending if there is a letter in front of it. e.g. "cost" : "C1000" showing they spent $1000. So for example I want to search when the user spends between C1000 and C20000. which would be added on to this index="silverprod" source=*finance* ("Lambda" "Payload") NOT (lambda-warmer) *topup*
... View more
07-21-2021
04:22 PM
@venkatasri yes it did! thank you so much
... View more
07-20-2021
10:24 PM
sorry @venkatasri I was wrong, i need to create a graph/list and count of how many differnet users are showed in the results, is this possible?
... View more
07-20-2021
10:11 PM
@venkatasri Thank you so much!! you have been a massive help!!
... View more
07-20-2021
09:41 PM
Hi, @venkatasri the event text contains this text "Lambda Request Payload -> {"user":"8573993" etc..." when i try the below i get nothing in the sampling, is this because it's not a searchable parameter? as there are no results in statistics. What I am looking for is to get the a result e.g. "user":"8573993" = 12, showing the top 5 most frequently occurring users
... View more
07-20-2021
09:12 PM
Hi @venkatasri , thank you this has helped! Would you also know how to do a unique count as well for instance, use this query index="silverprod" source=*finance* ("Lambda" "Payload") NOT (lambda-warmer) *topup* | timechart count and i want to find what users occur the most in these calls. the parameter is just "user". e.g. user = 76757549 and the users that occur most in the search over the 3 months. Thanks again, Callum
... View more
07-20-2021
07:27 PM
Hey Everyone, I am new to Splunk and am struggling to create a simple time chart for a query I have made. I want to create a time chart over the last 3 months of the frequency of a specific search I have made. To visualise how frequent the results are created. My query: index="silverprod" source=*finance* ("Lambda" "Payload") NOT (lambda-warmer) *topup* some help would be greatly appreciated
... View more
Labels
- Labels:
-
timechart
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-22-2022
03:23 AM
|
